theory ArchArch_IF

lemma mapM_x_swp_store_pte_invs' :
  "\<lbrace>invs and (\<lambda>s. cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s)\<rbrace>
   mapM_x (swp store_pte InvalidPTE) [word , word + 4 .e. word + 2 ^ pt_bits - 1]
   \<lbrace>\<lambda>_. invs\<rbrace>" apply (rule hoare_pre) apply (rule mapM_x_swp_store_pte_invs) apply clarsimp apply (case_tac slot) apply (rule_tac x=a in exI) apply (rule_tac x=b in exI) apply (auto simp: cte_wp_at_page_cap_bits invs_def valid_state_def valid_pspace_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs and cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot\<rbrace> mapM_x (swp store_pte InvalidPTE) [word , word + 4 .e. word + 2 ^ pt_bits - 1] \<lbrace>\<lambda>_. invs\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<lbrace>?Q\<rbrace> mapM_x (swp store_pte InvalidPTE) [word , word + 4 .e. word + 2 ^ pt_bits - 1] \<lbrace>\<lambda>_. invs\<rbrace>
 2. \<And>s. (invs and cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot) s \<Longrightarrow> ?Q s proof (prove)
goal (1 subgoal):
 1. \<And>s. (invs and cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot) s \<Longrightarrow> (invs and (\<lambda>s. (\<exists>p\<in>set [word , word + 4 .e. word + 2 ^ pt_bits - 1]. \<exists>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s) \<longrightarrow> valid_pte InvalidPTE s) and (\<lambda>s. wellformed_pte InvalidPTE) and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. (\<lambda>x. x && ~~ mask pt_bits) ` set [word , word + 4 .e. word + 2 ^ pt_bits - 1] \<subseteq> obj_refs c \<and> is_pt_cap c \<and> (InvalidPTE = InvalidPTE \<or> cap_asid c \<noteq> None)) slot s) and (\<lambda>s. \<forall>p\<in>set [word , word + 4 .e. word + 2 ^ pt_bits - 1]. \<forall>ref. (ref \<rhd> (p && ~~ mask pt_bits)) s \<longrightarrow> (\<forall>q. pte_ref_pages InvalidPTE = Some q \<longrightarrow> (\<exists>p' cap. caps_of_state s p' = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (p && mask pt_bits >> 2) (Some APageTable) # ref))))) s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>invs s; cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s\<rbrakk> \<Longrightarrow> \<exists>a b. cte_wp_at (\<lambda>c. (\<lambda>x. x && ~~ mask pt_bits) ` set [word , word + 4 .e. word + 2 ^ pt_bits - 1] \<subseteq> obj_refs c \<and> is_pt_cap c) (a, b) s proof (prove)
goal (1 subgoal):
 1. \<And>s a b. \<lbrakk>invs s; cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; slot = (a, b)\<rbrakk> \<Longrightarrow> \<exists>a b. cte_wp_at (\<lambda>c. (\<lambda>x. x && ~~ mask pt_bits) ` set [word , word + 4 .e. word + 2 ^ pt_bits - 1] \<subseteq> obj_refs c \<and> is_pt_cap c) (a, b) s proof (prove)
goal (1 subgoal):
 1. \<And>s a b. \<lbrakk>invs s; cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; slot = (a, b)\<rbrakk> \<Longrightarrow> \<exists>b. cte_wp_at (\<lambda>c. (\<lambda>x. x && ~~ mask pt_bits) ` set [word , word + 4 .e. word + 2 ^ pt_bits - 1] \<subseteq> obj_refs c \<and> is_pt_cap c) (a, b) s proof (prove)
goal (1 subgoal):
 1. \<And>s a b. \<lbrakk>invs s; cte_wp_at ((=) (ArchObjectCap (PageTableCap word option))) slot s; slot = (a, b)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>c. (\<lambda>x. x && ~~ mask pt_bits) ` set [word , word + 4 .e. word + 2 ^ pt_bits - 1] \<subseteq> obj_refs c \<and> is_pt_cap c) (a, b) s proof (prove)
goal:
No subgoals!