theory KHeap_DR

lemma thread_get_corres:
  "\<lbrakk>did = thread; dcorres rv \<top> P' (f tcb) (g (t tcb')) \<rbrakk>
  \<Longrightarrow> dcorres rv \<top> (P' and not_idle_thread thread and valid_irq_node
    and (\<lambda>s. transform_tcb (machine_state s) thread tcb' etcb' = Tcb tcb) and ko_at (TCB tcb') thread
    and (\<lambda>s. get_etcb thread s = Some etcb'))
    (get_thread did >>= f) (thread_get t thread >>= g)" apply (clarsimp simp:get_thread_def thread_get_def bind_assoc) apply (rule dcorres_gets_the) apply (clarsimp dest!:get_tcb_SomeD get_etcb_SomeD simp:obj_at_def opt_object_tcb is_etcb_at_def) apply (clarsimp dest!:get_tcb_rev get_etcb_rev) apply (frule opt_object_tcb) apply (simp add:not_idle_thread_def)+ apply (case_tac obj) apply ((simp add:transform_tcb_def)+)[2] apply clarsimp apply (rule dcorres_absorb_pfx) apply (assumption) apply simp+ apply (clarsimp simp:obj_at_def dest!:get_tcb_rev) apply (drule opt_object_tcb) apply (simp add:not_idle_thread_def get_etcb_def)+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb'))\<rbrakk> \<Longrightarrow> dcorres rv (\<lambda>_. True) (P' and not_idle_thread thread and valid_irq_node and (\<lambda>s. transform_tcb (machine_state s) thread tcb' etcb' = Tcb tcb) and ko_at (TCB tcb') thread and (\<lambda>s. get_etcb thread s = Some etcb')) (get_thread did >>= f) (thread_get t thread >>= g) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb'))\<rbrakk> \<Longrightarrow> dcorres rv (\<lambda>_. True) (P' and not_idle_thread thread and valid_irq_node and (\<lambda>s. transform_tcb (machine_state s) thread tcb' etcb' = Tcb tcb) and ko_at (TCB tcb') thread and (\<lambda>s. get_etcb thread s = Some etcb')) (do x <- KHeap_D.get_object thread;
(case x of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f
od) (do tcb <- gets_the (get_tcb thread);
g (t tcb)
od) proof (prove)
goal (2 subgoals):
 1. \<And>s s' obj obj'. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); s = transform s'; True; (P' and not_idle_thread thread and valid_irq_node and (\<lambda>s. transform_tcb (machine_state s) thread tcb' etcb' = Tcb tcb) and ko_at (TCB tcb') thread and (\<lambda>s. get_etcb thread s = Some etcb')) s'; get_tcb thread s' = Some obj'; cdl_objects s thread = Some obj\<rbrakk> \<Longrightarrow> dcorres rv ((=) s) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t obj'))
 2. \<And>s s'. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); s = transform s'; True; (P' and not_idle_thread thread and valid_irq_node and (\<lambda>s. transform_tcb (machine_state s) thread tcb' etcb' = Tcb tcb) and ko_at (TCB tcb') thread and (\<lambda>s. get_etcb thread s = Some etcb')) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None proof (prove)
goal (2 subgoals):
 1. \<And>s' obj. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); cdl_objects (transform s') thread = Some obj; P' s'; not_idle_thread thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = Tcb tcb; kheap s' thread = Some (TCB tcb'); ekheap s' thread = Some etcb'\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 2. \<And>s s'. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); s = transform s'; True; (P' and not_idle_thread thread and valid_irq_node and (\<lambda>s. transform_tcb (machine_state s) thread tcb' etcb' = Tcb tcb) and ko_at (TCB tcb') thread and (\<lambda>s. get_etcb thread s = Some etcb')) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None proof (prove)
goal (2 subgoals):
 1. \<And>s' obj. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); cdl_objects (transform s') thread = Some obj; P' s'; not_idle_thread thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = Tcb tcb; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 2. \<And>s s'. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); s = transform s'; True; (P' and not_idle_thread thread and valid_irq_node and (\<lambda>s. transform_tcb (machine_state s) thread tcb' etcb' = Tcb tcb) and ko_at (TCB tcb') thread and (\<lambda>s. get_etcb thread s = Some etcb')) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None proof (prove)
goal (4 subgoals):
 1. \<And>s' obj. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); cdl_objects (transform s') thread = Some obj; P' s'; not_idle_thread thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = Tcb tcb; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'\<rbrakk> \<Longrightarrow> get_etcb thread s' = Some (?etcb19 s' obj)
 2. \<And>s' obj. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); cdl_objects (transform s') thread = Some obj; P' s'; not_idle_thread thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = Tcb tcb; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'\<rbrakk> \<Longrightarrow> thread \<noteq> idle_thread s'
 3. \<And>s' obj. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); cdl_objects (transform s') thread = Some obj; P' s'; not_idle_thread thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = Tcb tcb; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some (transform_tcb (machine_state s') thread tcb' (?etcb19 s' obj))\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 4. \<And>s s'. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); s = transform s'; True; (P' and not_idle_thread thread and valid_irq_node and (\<lambda>s. transform_tcb (machine_state s) thread tcb' etcb' = Tcb tcb) and ko_at (TCB tcb') thread and (\<lambda>s. get_etcb thread s = Some etcb')) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None proof (prove)
goal (2 subgoals):
 1. \<And>s' obj. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 2. \<And>s s'. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); s = transform s'; True; (P' and not_idle_thread thread and valid_irq_node and (\<lambda>s. transform_tcb (machine_state s) thread tcb' etcb' = Tcb tcb) and ko_at (TCB tcb') thread and (\<lambda>s. get_etcb thread s = Some etcb')) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None proof (prove)
goal (11 subgoals):
 1. \<And>s' obj. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = cdl_object.Endpoint\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 2. \<And>s' obj. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = cdl_object.Notification\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 3. \<And>s' obj x3. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = Tcb x3\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 4. \<And>s' obj x4. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = cdl_object.CNode x4\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 5. \<And>s' obj x5. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = AsidPool x5\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 6. \<And>s' obj x6. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = cdl_object.PageTable x6\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 7. \<And>s' obj x7. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = cdl_object.PageDirectory x7\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 8. \<And>s' obj x8. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = Frame x8\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 9. \<And>s' obj. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = cdl_object.Untyped\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 10. \<And>s' obj x10. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = IRQNode x10\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>s' obj x3. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = Tcb x3\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 2. \<And>s' obj x4. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = cdl_object.CNode x4\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 3. \<And>s' obj x5. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = AsidPool x5\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 4. \<And>s' obj x6. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = cdl_object.PageTable x6\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 5. \<And>s' obj x7. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = cdl_object.PageDirectory x7\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 6. \<And>s' obj x8. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = Frame x8\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 7. \<And>s' obj. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = cdl_object.Untyped\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 8. \<And>s' obj x10. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = IRQNode x10\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 9. \<And>s s'. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); s = transform s'; True; (P' and not_idle_thread thread and valid_irq_node and (\<lambda>s. transform_tcb (machine_state s) thread tcb' etcb' = Tcb tcb) and ko_at (TCB tcb') thread and (\<lambda>s. get_etcb thread s = Some etcb')) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None proof (prove)
goal (9 subgoals):
 1. \<And>s'. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = Tcb tcb; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some (Tcb tcb)\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') (f tcb) (g (t tcb'))
 2. \<And>s' obj x4. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = cdl_object.CNode x4\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 3. \<And>s' obj x5. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = AsidPool x5\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 4. \<And>s' obj x6. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = cdl_object.PageTable x6\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 5. \<And>s' obj x7. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = cdl_object.PageDirectory x7\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 6. \<And>s' obj x8. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = Frame x8\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 7. \<And>s' obj. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = cdl_object.Untyped\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 8. \<And>s' obj x10. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = IRQNode x10\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 9. \<And>s s'. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); s = transform s'; True; (P' and not_idle_thread thread and valid_irq_node and (\<lambda>s. transform_tcb (machine_state s) thread tcb' etcb' = Tcb tcb) and ko_at (TCB tcb') thread and (\<lambda>s. get_etcb thread s = Some etcb')) s'; get_tcb thread s' \<noteq> None\<rbrakk> \<Longrightarrow> cdl_objects s thread \<noteq> None proof (prove)
goal (12 subgoals):
 1. \<And>s'. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = Tcb tcb; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some (Tcb tcb)\<rbrakk> \<Longrightarrow> dcorres rv (?P31 s') (?P'31 s') (f tcb) (g (t tcb'))
 2. \<And>s'. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = Tcb tcb; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some (Tcb tcb)\<rbrakk> \<Longrightarrow> transform s' = transform s'
 3. \<And>s'. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = Tcb tcb; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some (Tcb tcb)\<rbrakk> \<Longrightarrow> ?P31 s' (transform s')
 4. \<And>s'. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = Tcb tcb; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some (Tcb tcb)\<rbrakk> \<Longrightarrow> ?P'31 s' s'
 5. \<And>s' obj x4. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = cdl_object.CNode x4\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 6. \<And>s' obj x5. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = AsidPool x5\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 7. \<And>s' obj x6. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = cdl_object.PageTable x6\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 8. \<And>s' obj x7. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = cdl_object.PageDirectory x7\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 9. \<And>s' obj x8. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = Frame x8\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 10. \<And>s' obj. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = cdl_object.Untyped\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s'. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = Tcb tcb; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some (Tcb tcb)\<rbrakk> \<Longrightarrow> transform s' = transform s'
 2. \<And>s'. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = Tcb tcb; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some (Tcb tcb)\<rbrakk> \<Longrightarrow> True
 3. \<And>s'. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = Tcb tcb; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some (Tcb tcb)\<rbrakk> \<Longrightarrow> P' s'
 4. \<And>s' obj x4. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = cdl_object.CNode x4\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 5. \<And>s' obj x5. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = AsidPool x5\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 6. \<And>s' obj x6. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = cdl_object.PageTable x6\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 7. \<And>s' obj x7. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = cdl_object.PageDirectory x7\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 8. \<And>s' obj x8. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = Frame x8\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 9. \<And>s' obj. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = cdl_object.Untyped\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
 10. \<And>s' obj x10. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); Tcb tcb = obj; P' s'; thread \<noteq> idle_thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = obj; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'; cdl_objects (transform s') thread = Some obj; obj = IRQNode x10\<rbrakk> \<Longrightarrow> dcorres rv ((=) (transform s')) ((=) s') ((case obj of Tcb x \<Rightarrow> return x | _ \<Rightarrow> fail) >>= f) (g (t tcb'))
A total of 11 subgoals... proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); s = transform s'; P' s' \<and> not_idle_thread thread s' \<and> valid_irq_node s' \<and> transform_tcb (machine_state s') thread tcb' etcb' = Tcb tcb \<and> ko_at (TCB tcb') thread s' \<and> get_etcb thread s' = Some etcb'; \<exists>y. get_tcb thread s' = Some y\<rbrakk> \<Longrightarrow> \<exists>y. cdl_objects (transform s') thread = Some y proof (prove)
goal (1 subgoal):
 1. \<And>s'. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); P' s'; not_idle_thread thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = Tcb tcb; get_etcb thread s' = Some etcb'; get_tcb thread s' = Some tcb'\<rbrakk> \<Longrightarrow> \<exists>y. cdl_objects (transform s') thread = Some y proof (prove)
goal (3 subgoals):
 1. \<And>s'. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); P' s'; not_idle_thread thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = Tcb tcb; get_etcb thread s' = Some etcb'\<rbrakk> \<Longrightarrow> get_etcb thread s' = Some (?etcb45 s')
 2. \<And>s'. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); P' s'; not_idle_thread thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = Tcb tcb; get_etcb thread s' = Some etcb'\<rbrakk> \<Longrightarrow> thread \<noteq> idle_thread s'
 3. \<And>s'. \<lbrakk>did = thread; dcorres rv (\<lambda>_. True) P' (f tcb) (g (t tcb')); P' s'; not_idle_thread thread s'; valid_irq_node s'; transform_tcb (machine_state s') thread tcb' etcb' = Tcb tcb; get_etcb thread s' = Some etcb'; cdl_objects (transform s') thread = Some (transform_tcb (machine_state s') thread tcb' (?etcb45 s'))\<rbrakk> \<Longrightarrow> \<exists>y. cdl_objects (transform s') thread = Some y proof (prove)
goal:
No subgoals!