theory Retype_IF

lemma delete_objects_pspace_no_overlap_again:
  "\<lbrace>pspace_aligned and valid_objs and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>cp. is_untyped_cap cp \<and>
                                                                  obj_ref_of cp = ptr \<and>
                                                                  bits_of cp = sz) slot s)
                                  and K (S \<subseteq> {ptr .. ptr + 2 ^ sz - 1})\<rbrace>
   delete_objects ptr sz
   \<lbrace>\<lambda>_. pspace_no_overlap S\<rbrace>" unfolding delete_objects_def do_machine_op_def apply (wp | simp add: split_def detype_machine_state_update_comm)+ apply (clarsimp simp: cte_wp_at_caps_of_state is_cap_simps bits_of_def) apply (drule caps_of_state_cteD) apply (frule cte_wp_at_valid_objs_valid_cap, clarsimp+) apply (erule pspace_no_overlap_subset[rotated]) apply (rule pspace_no_overlap_subset, rule pspace_no_overlap_detype, simp+) apply (simp add: valid_cap_simps cap_aligned_def field_simps) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>pspace_aligned and valid_objs and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>cp. is_untyped_cap cp \<and> obj_ref_of cp = ptr \<and> bits_of cp = sz) slot s) and K (S \<subseteq> {ptr..ptr + 2 ^ sz - 1})\<rbrace> delete_objects ptr sz \<lbrace>\<lambda>_. pspace_no_overlap S\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>pspace_aligned and valid_objs and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>cp. is_untyped_cap cp \<and> obj_ref_of cp = ptr \<and> bits_of cp = sz) slot s) and K (S \<subseteq> {ptr..ptr + 2 ^ sz - 1})\<rbrace> do do ms <- gets machine_state;
(r, ms') <- select_f (freeMemory ptr sz ms);
modify (machine_state_update (\<lambda>_. ms'));
return r
od;
modify (detype {ptr..ptr + 2 ^ sz - 1})
od \<lbrace>\<lambda>_. pspace_no_overlap S\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s. pspace_aligned s \<and> valid_objs s \<and> (\<exists>a b. cte_wp_at (\<lambda>cp. is_untyped_cap cp \<and> obj_ref_of cp = ptr \<and> bits_of cp = sz) (a, b) s) \<and> S \<subseteq> {ptr..ptr + 2 ^ sz - 1} \<Longrightarrow> (\<exists>b. ((), b) \<in> fst (freeMemory ptr sz (machine_state s))) \<longrightarrow> pspace_no_overlap S (detype {ptr..ptr + 2 ^ sz - 1} s) proof (prove)
goal (1 subgoal):
 1. \<And>s a b dev f ba. \<lbrakk>pspace_aligned s; valid_objs s; S \<subseteq> {ptr..ptr + 2 ^ sz - 1}; caps_of_state s (a, b) = Some (UntypedCap dev ptr sz f); ((), ba) \<in> fst (freeMemory ptr sz (machine_state s))\<rbrakk> \<Longrightarrow> pspace_no_overlap S (detype {ptr..ptr + 2 ^ sz - 1} s) proof (prove)
goal (1 subgoal):
 1. \<And>s a b dev f ba. \<lbrakk>pspace_aligned s; valid_objs s; S \<subseteq> {ptr..ptr + 2 ^ sz - 1}; ((), ba) \<in> fst (freeMemory ptr sz (machine_state s)); cte_wp_at ((=) (UntypedCap dev ptr sz f)) (a, b) s\<rbrakk> \<Longrightarrow> pspace_no_overlap S (detype {ptr..ptr + 2 ^ sz - 1} s) proof (prove)
goal (1 subgoal):
 1. \<And>s a b dev f ba. \<lbrakk>pspace_aligned s; valid_objs s; S \<subseteq> {ptr..ptr + 2 ^ sz - 1}; ((), ba) \<in> fst (freeMemory ptr sz (machine_state s)); cte_wp_at ((=) (UntypedCap dev ptr sz f)) (a, b) s; s \<turnstile> UntypedCap dev ptr sz f\<rbrakk> \<Longrightarrow> pspace_no_overlap S (detype {ptr..ptr + 2 ^ sz - 1} s) proof (prove)
goal (1 subgoal):
 1. \<And>s a b dev f ba. \<lbrakk>pspace_aligned s; valid_objs s; ((), ba) \<in> fst (freeMemory ptr sz (machine_state s)); cte_wp_at ((=) (UntypedCap dev ptr sz f)) (a, b) s; s \<turnstile> UntypedCap dev ptr sz f\<rbrakk> \<Longrightarrow> pspace_no_overlap {ptr..ptr + 2 ^ sz - 1} (detype {ptr..ptr + 2 ^ sz - 1} s) proof (prove)
goal (1 subgoal):
 1. \<And>s a b dev f ba. \<lbrakk>pspace_aligned s; valid_objs s; ((), ba) \<in> fst (freeMemory ptr sz (machine_state s)); cte_wp_at ((=) (UntypedCap dev ptr sz f)) (a, b) s; s \<turnstile> UntypedCap dev ptr sz f\<rbrakk> \<Longrightarrow> ptr \<le> ptr + 2 ^ sz - 1 \<longrightarrow> ptr + 2 ^ sz - 1 \<le> (ptr && ~~ mask sz) + (2 ^ sz - 1) proof (prove)
goal:
No subgoals!