theory ArchADT_IF

lemma invoke_tcb_irq_state_inv[ADT_IF_assms]:
  "\<lbrace>(\<lambda>s. irq_state_inv st s) and domain_sep_inv False sta
                             and tcb_inv_wf tinv and K (irq_is_recurring irq st)\<rbrace>
   invoke_tcb tinv
   \<lbrace>\<lambda>_ s. irq_state_inv st s\<rbrace>, \<lbrace>\<lambda>_. irq_state_next st\<rbrace>" apply (case_tac tinv) apply ((wp hoare_vcg_if_lift  mapM_x_wp[OF _ subset_refl]
               | wpc
               | simp split del: if_split add: check_cap_at_def
               | clarsimp
               | wp (once) irq_state_inv_triv)+)[3] defer apply ((wp irq_state_inv_triv | simp)+)[2] 
  (* just ThreadControl left *)
   apply (simp add: split_def cong: option.case_cong) by (wp hoare_vcg_all_lift_R hoare_vcg_all_lift hoare_vcg_const_imp_lift_R
         checked_cap_insert_domain_sep_inv cap_delete_deletes
         cap_delete_irq_state_inv[where st=st and sta=sta and irq=irq]
         cap_delete_irq_state_next[where st=st and sta=sta and irq=irq]
         cap_delete_valid_cap cap_delete_cte_at
      | wpc
      | simp add: emptyable_def tcb_cap_cases_def tcb_cap_valid_def
                  tcb_at_st_tcb_at option_update_thread_def
      | strengthen use_no_cap_to_obj_asid_strg
      | wp (once) irq_state_inv_triv hoare_drop_imps
      | clarsimp split: option.splits | intro impI conjI allI)+

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>irq_state_inv st and domain_sep_inv False sta and tcb_inv_wf tinv and K (irq_is_recurring irq st)\<rbrace> invoke_tcb tinv \<lbrace>\<lambda>_. irq_state_inv st\<rbrace>, \<lbrace>\<lambda>_. irq_state_next st\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>x11 x12 x13 x14. tinv = WriteRegisters x11 x12 x13 x14 \<Longrightarrow> \<lbrace>irq_state_inv st and domain_sep_inv False sta and tcb_inv_wf tinv and K (irq_is_recurring irq st)\<rbrace> invoke_tcb tinv \<lbrace>\<lambda>_. irq_state_inv st\<rbrace>, \<lbrace>\<lambda>_. irq_state_next st\<rbrace>
 2. \<And>x21 x22 x23 x24. tinv = ReadRegisters x21 x22 x23 x24 \<Longrightarrow> \<lbrace>irq_state_inv st and domain_sep_inv False sta and tcb_inv_wf tinv and K (irq_is_recurring irq st)\<rbrace> invoke_tcb tinv \<lbrace>\<lambda>_. irq_state_inv st\<rbrace>, \<lbrace>\<lambda>_. irq_state_next st\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36 x37. tinv = CopyRegisters x31 x32 x33 x34 x35 x36 x37 \<Longrightarrow> \<lbrace>irq_state_inv st and domain_sep_inv False sta and tcb_inv_wf tinv and K (irq_is_recurring irq st)\<rbrace> invoke_tcb tinv \<lbrace>\<lambda>_. irq_state_inv st\<rbrace>, \<lbrace>\<lambda>_. irq_state_next st\<rbrace>
 4. \<And>x41 x42 x43 x44 x45 x46 x47 x48. tinv = ThreadControl x41 x42 x43 x44 x45 x46 x47 x48 \<Longrightarrow> \<lbrace>irq_state_inv st and domain_sep_inv False sta and tcb_inv_wf tinv and K (irq_is_recurring irq st)\<rbrace> invoke_tcb tinv \<lbrace>\<lambda>_. irq_state_inv st\<rbrace>, \<lbrace>\<lambda>_. irq_state_next st\<rbrace>
 5. \<And>x5. tinv = Suspend x5 \<Longrightarrow> \<lbrace>irq_state_inv st and domain_sep_inv False sta and tcb_inv_wf tinv and K (irq_is_recurring irq st)\<rbrace> invoke_tcb tinv \<lbrace>\<lambda>_. irq_state_inv st\<rbrace>, \<lbrace>\<lambda>_. irq_state_next st\<rbrace>
 6. \<And>x6. tinv = Resume x6 \<Longrightarrow> \<lbrace>irq_state_inv st and domain_sep_inv False sta and tcb_inv_wf tinv and K (irq_is_recurring irq st)\<rbrace> invoke_tcb tinv \<lbrace>\<lambda>_. irq_state_inv st\<rbrace>, \<lbrace>\<lambda>_. irq_state_next st\<rbrace>
 7. \<And>x71 x72. tinv = NotificationControl x71 x72 \<Longrightarrow> \<lbrace>irq_state_inv st and domain_sep_inv False sta and tcb_inv_wf tinv and K (irq_is_recurring irq st)\<rbrace> invoke_tcb tinv \<lbrace>\<lambda>_. irq_state_inv st\<rbrace>, \<lbrace>\<lambda>_. irq_state_next st\<rbrace>
 8. \<And>x81 x82. tinv = SetTLSBase x81 x82 \<Longrightarrow> \<lbrace>irq_state_inv st and domain_sep_inv False sta and tcb_inv_wf tinv and K (irq_is_recurring irq st)\<rbrace> invoke_tcb tinv \<lbrace>\<lambda>_. irq_state_inv st\<rbrace>, \<lbrace>\<lambda>_. irq_state_next st\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>x41 x42 x43 x44 x45 x46 x47 x48. tinv = ThreadControl x41 x42 x43 x44 x45 x46 x47 x48 \<Longrightarrow> \<lbrace>irq_state_inv st and domain_sep_inv False sta and tcb_inv_wf tinv and K (irq_is_recurring irq st)\<rbrace> invoke_tcb tinv \<lbrace>\<lambda>_. irq_state_inv st\<rbrace>, \<lbrace>\<lambda>_. irq_state_next st\<rbrace>
 2. \<And>x5. tinv = Suspend x5 \<Longrightarrow> \<lbrace>irq_state_inv st and domain_sep_inv False sta and tcb_inv_wf tinv and K (irq_is_recurring irq st)\<rbrace> invoke_tcb tinv \<lbrace>\<lambda>_. irq_state_inv st\<rbrace>, \<lbrace>\<lambda>_. irq_state_next st\<rbrace>
 3. \<And>x6. tinv = Resume x6 \<Longrightarrow> \<lbrace>irq_state_inv st and domain_sep_inv False sta and tcb_inv_wf tinv and K (irq_is_recurring irq st)\<rbrace> invoke_tcb tinv \<lbrace>\<lambda>_. irq_state_inv st\<rbrace>, \<lbrace>\<lambda>_. irq_state_next st\<rbrace>
 4. \<And>x71 x72. tinv = NotificationControl x71 x72 \<Longrightarrow> \<lbrace>irq_state_inv st and domain_sep_inv False sta and tcb_inv_wf tinv and K (irq_is_recurring irq st)\<rbrace> invoke_tcb tinv \<lbrace>\<lambda>_. irq_state_inv st\<rbrace>, \<lbrace>\<lambda>_. irq_state_next st\<rbrace>
 5. \<And>x81 x82. tinv = SetTLSBase x81 x82 \<Longrightarrow> \<lbrace>irq_state_inv st and domain_sep_inv False sta and tcb_inv_wf tinv and K (irq_is_recurring irq st)\<rbrace> invoke_tcb tinv \<lbrace>\<lambda>_. irq_state_inv st\<rbrace>, \<lbrace>\<lambda>_. irq_state_next st\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>x5. tinv = Suspend x5 \<Longrightarrow> \<lbrace>irq_state_inv st and domain_sep_inv False sta and tcb_inv_wf tinv and K (irq_is_recurring irq st)\<rbrace> invoke_tcb tinv \<lbrace>\<lambda>_. irq_state_inv st\<rbrace>, \<lbrace>\<lambda>_. irq_state_next st\<rbrace>
 2. \<And>x6. tinv = Resume x6 \<Longrightarrow> \<lbrace>irq_state_inv st and domain_sep_inv False sta and tcb_inv_wf tinv and K (irq_is_recurring irq st)\<rbrace> invoke_tcb tinv \<lbrace>\<lambda>_. irq_state_inv st\<rbrace>, \<lbrace>\<lambda>_. irq_state_next st\<rbrace>
 3. \<And>x71 x72. tinv = NotificationControl x71 x72 \<Longrightarrow> \<lbrace>irq_state_inv st and domain_sep_inv False sta and tcb_inv_wf tinv and K (irq_is_recurring irq st)\<rbrace> invoke_tcb tinv \<lbrace>\<lambda>_. irq_state_inv st\<rbrace>, \<lbrace>\<lambda>_. irq_state_next st\<rbrace>
 4. \<And>x81 x82. tinv = SetTLSBase x81 x82 \<Longrightarrow> \<lbrace>irq_state_inv st and domain_sep_inv False sta and tcb_inv_wf tinv and K (irq_is_recurring irq st)\<rbrace> invoke_tcb tinv \<lbrace>\<lambda>_. irq_state_inv st\<rbrace>, \<lbrace>\<lambda>_. irq_state_next st\<rbrace>
 5. \<And>x41 x42 x43 x44 x45 x46 x47 x48. tinv = ThreadControl x41 x42 x43 x44 x45 x46 x47 x48 \<Longrightarrow> \<lbrace>irq_state_inv st and domain_sep_inv False sta and tcb_inv_wf tinv and K (irq_is_recurring irq st)\<rbrace> invoke_tcb tinv \<lbrace>\<lambda>_. irq_state_inv st\<rbrace>, \<lbrace>\<lambda>_. irq_state_next st\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>x71 x72. tinv = NotificationControl x71 x72 \<Longrightarrow> \<lbrace>irq_state_inv st and domain_sep_inv False sta and tcb_inv_wf tinv and K (irq_is_recurring irq st)\<rbrace> invoke_tcb tinv \<lbrace>\<lambda>_. irq_state_inv st\<rbrace>, \<lbrace>\<lambda>_. irq_state_next st\<rbrace>
 2. \<And>x81 x82. tinv = SetTLSBase x81 x82 \<Longrightarrow> \<lbrace>irq_state_inv st and domain_sep_inv False sta and tcb_inv_wf tinv and K (irq_is_recurring irq st)\<rbrace> invoke_tcb tinv \<lbrace>\<lambda>_. irq_state_inv st\<rbrace>, \<lbrace>\<lambda>_. irq_state_next st\<rbrace>
 3. \<And>x41 x42 x43 x44 x45 x46 x47 x48. tinv = ThreadControl x41 x42 x43 x44 x45 x46 x47 x48 \<Longrightarrow> \<lbrace>irq_state_inv st and domain_sep_inv False sta and tcb_inv_wf tinv and K (irq_is_recurring irq st)\<rbrace> invoke_tcb tinv \<lbrace>\<lambda>_. irq_state_inv st\<rbrace>, \<lbrace>\<lambda>_. irq_state_next st\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>x71 x72. tinv = NotificationControl x71 x72 \<Longrightarrow> \<lbrace>irq_state_inv st and domain_sep_inv False sta and tcb_inv_wf tinv and K (irq_is_recurring irq st)\<rbrace> invoke_tcb tinv \<lbrace>\<lambda>_. irq_state_inv st\<rbrace>, \<lbrace>\<lambda>_. irq_state_next st\<rbrace>
 2. \<And>x81 x82. tinv = SetTLSBase x81 x82 \<Longrightarrow> \<lbrace>irq_state_inv st and domain_sep_inv False sta and tcb_inv_wf tinv and K (irq_is_recurring irq st)\<rbrace> invoke_tcb tinv \<lbrace>\<lambda>_. irq_state_inv st\<rbrace>, \<lbrace>\<lambda>_. irq_state_next st\<rbrace>
 3. \<And>x41 x42 x43 x44 x45 x46 x47 x48. tinv = ThreadControl x41 x42 x43 x44 x45 x46 x47 x48 \<Longrightarrow> \<lbrace>irq_state_inv st and domain_sep_inv False sta and tcb_inv_wf tinv and K (irq_is_recurring irq st)\<rbrace> invoke_tcb tinv \<lbrace>\<lambda>_. irq_state_inv st\<rbrace>, \<lbrace>\<lambda>_. irq_state_next st\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>x71 x72. tinv = NotificationControl x71 x72 \<Longrightarrow> \<lbrace>irq_state_inv st and domain_sep_inv False sta and (tcb_at x71 and ex_nonz_cap_to x71 and (case x72 of None \<Rightarrow> \<lambda>_. True | Some ntfnptr \<Rightarrow> obj_at (\<lambda>ko. \<exists>ntfn. ko = Notification ntfn \<and> ntfn_bound_tcb ntfn = None \<and> (\<forall>q. ntfn_obj ntfn \<noteq> WaitingNtfn q)) ntfnptr and ex_nonz_cap_to ntfnptr and bound_tcb_at ((=) None) x71)) and (\<lambda>y. irq_is_recurring irq st)\<rbrace> invoke_tcb (NotificationControl x71 x72) \<lbrace>\<lambda>_. irq_state_inv st\<rbrace>, \<lbrace>\<lambda>_. irq_state_next st\<rbrace>
 2. \<And>x81 x82. tinv = SetTLSBase x81 x82 \<Longrightarrow> \<lbrace>irq_state_inv st and domain_sep_inv False sta and tcb_inv_wf tinv and K (irq_is_recurring irq st)\<rbrace> invoke_tcb tinv \<lbrace>\<lambda>_. irq_state_inv st\<rbrace>, \<lbrace>\<lambda>_. irq_state_next st\<rbrace>
 3. \<And>x41 x42 x43 x44 x45 x46 x47 x48. tinv = ThreadControl x41 x42 x43 x44 x45 x46 x47 x48 \<Longrightarrow> \<lbrace>irq_state_inv st and domain_sep_inv False sta and tcb_inv_wf tinv and K (irq_is_recurring irq st)\<rbrace> invoke_tcb tinv \<lbrace>\<lambda>_. irq_state_inv st\<rbrace>, \<lbrace>\<lambda>_. irq_state_next st\<rbrace>