theory ArchNoninterference

lemma dmo_clearExMonitor_reads_respects_g':
  "equiv_valid (reads_equiv_g aag) (affects_equiv aag l)
               (\<lambda>s s'. affects_equiv aag l s s' \<and> exclusive_state_equiv s s') \<top>
               (do_machine_op clearExMonitor)" apply (simp add: clearExMonitor_def) apply (wp dmo_ev ev_modify) apply (simp add: reads_equiv_g_def reads_equiv_def2 affects_equiv_def2 globals_equiv_def
                   idle_equiv_def states_equiv_for_def equiv_for_def equiv_asids_def equiv_asid_def) apply metis done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. equiv_valid (reads_equiv_g aag) (affects_equiv aag l) (\<lambda>s s'. affects_equiv aag l s s' \<and> exclusive_state (machine_state s) = exclusive_state (machine_state s')) (\<lambda>_. True) (do_machine_op clearExMonitor) proof (prove)
goal (1 subgoal):
 1. equiv_valid (reads_equiv_g aag) (affects_equiv aag l) (\<lambda>s s'. affects_equiv aag l s s' \<and> exclusive_state (machine_state s) = exclusive_state (machine_state s')) (\<lambda>_. True) (do_machine_op (modify (exclusive_state_update (\<lambda>_. default_exclusive_state)))) proof (prove)
goal (1 subgoal):
 1. \<And>s s' sa t. \<lbrakk>K (True \<and> True) sa; K (True \<and> True) t; affects_equiv aag l (s\<lparr>machine_state := sa\<rparr>) (s'\<lparr>machine_state := t\<rparr>); reads_equiv_g aag (s\<lparr>machine_state := sa\<rparr>) (s'\<lparr>machine_state := t\<rparr>)\<rbrakk> \<Longrightarrow> reads_equiv_g aag (s\<lparr>machine_state := sa\<lparr>exclusive_state := default_exclusive_state\<rparr>\<rparr>) (s'\<lparr>machine_state := t\<lparr>exclusive_state := default_exclusive_state\<rparr>\<rparr>) \<and> affects_equiv aag l (s\<lparr>machine_state := sa\<lparr>exclusive_state := default_exclusive_state\<rparr>\<rparr>) (s'\<lparr>machine_state := t\<lparr>exclusive_state := default_exclusive_state\<rparr>\<rparr>) \<and> exclusive_state (machine_state (s\<lparr>machine_state := sa\<lparr>exclusive_state := default_exclusive_state\<rparr>\<rparr>)) = exclusive_state (machine_state (s'\<lparr>machine_state := t\<lparr>exclusive_state := default_exclusive_state\<rparr>\<rparr>)) proof (prove)
goal (1 subgoal):
 1. \<And>s s' sa t. \<lbrakk>(\<forall>x. aag_can_affect aag l x \<longrightarrow> kheap s x = kheap s' x) \<and> (\<forall>x. aag_can_affect aag l x \<longrightarrow> underlying_memory sa x = underlying_memory t x) \<and> (\<forall>x. aag_can_affect aag l x \<longrightarrow> device_state sa x = device_state t x) \<and> (\<forall>a. aag_can_affect aag l a \<longrightarrow> (\<forall>b. cdt s (a, b) = cdt s' (a, b))) \<and> (\<forall>x. aag_can_affect aag l x \<longrightarrow> ekheap s x = ekheap s' x) \<and> (\<forall>a. aag_can_affect aag l a \<longrightarrow> (\<forall>b. cdt_list s (a, b) = cdt_list s' (a, b))) \<and> (\<forall>a. aag_can_affect aag l a \<longrightarrow> (\<forall>b. is_original_cap s (a, b) = is_original_cap s' (a, b))) \<and> (\<forall>x. aag_can_affect_irq aag l x \<longrightarrow> interrupt_states s x = interrupt_states s' x) \<and> (\<forall>x. aag_can_affect_irq aag l x \<longrightarrow> interrupt_irq_node s x = interrupt_irq_node s' x) \<and> (\<forall>x. aag_can_affect_domain aag l x \<longrightarrow> ready_queues s x = ready_queues s' x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> aag_can_affect_asid aag l asid \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table s' (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr s' \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap s' pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))); (\<forall>x. aag_can_read aag x \<longrightarrow> kheap s x = kheap s' x) \<and> (\<forall>x. aag_can_read aag x \<longrightarrow> underlying_memory sa x = underlying_memory t x) \<and> (\<forall>x. aag_can_read aag x \<longrightarrow> device_state sa x = device_state t x) \<and> (\<forall>a. aag_can_read aag a \<longrightarrow> (\<forall>b. cdt s (a, b) = cdt s' (a, b))) \<and> (\<forall>x. aag_can_read aag x \<longrightarrow> ekheap s x = ekheap s' x) \<and> (\<forall>a. aag_can_read aag a \<longrightarrow> (\<forall>b. cdt_list s (a, b) = cdt_list s' (a, b))) \<and> (\<forall>a. aag_can_read aag a \<longrightarrow> (\<forall>b. is_original_cap s (a, b) = is_original_cap s' (a, b))) \<and> (\<forall>x. aag_can_read_irq aag x \<longrightarrow> interrupt_states s x = interrupt_states s' x) \<and> (\<forall>x. aag_can_read_irq aag x \<longrightarrow> interrupt_irq_node s x = interrupt_irq_node s' x) \<and> (\<forall>x. aag_can_read_domain aag x \<longrightarrow> ready_queues s x = ready_queues s' x) \<and> (\<forall>asid. asid \<noteq> 0 \<and> aag_can_read_asid aag asid \<longrightarrow> asid_table s (asid_high_bits_of asid) = asid_table s' (asid_high_bits_of asid) \<and> (\<forall>pool_ptr. asid_table s (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr s' \<and> (\<forall>asid_pool asid_pool'. kheap s pool_ptr = Some (ArchObj (ASIDPool asid_pool)) \<and> kheap s' pool_ptr = Some (ArchObj (ASIDPool asid_pool')) \<longrightarrow> asid_pool (UCAST(32 \<rightarrow> 10) asid) = asid_pool' (UCAST(32 \<rightarrow> 10) asid)))) \<and> cur_thread s = cur_thread s' \<and> cur_domain s = cur_domain s' \<and> scheduler_action s = scheduler_action s' \<and> work_units_completed s = work_units_completed s' \<and> equiv_irq_state sa t \<and> arm_global_pd (arch_state s) = arm_global_pd (arch_state s') \<and> kheap s (arm_global_pd (arch_state s)) = kheap s' (arm_global_pd (arch_state s)) \<and> (cur_thread s \<noteq> idle_thread s \<longrightarrow> exclusive_state sa = exclusive_state t) \<and> idle_thread s = idle_thread s' \<and> (\<forall>tcb. kheap s (idle_thread s) = Some (TCB tcb) \<longrightarrow> (\<forall>tcb'. kheap s' (idle_thread s) = Some (TCB tcb') \<longrightarrow> arch_tcb_context_get (tcb_arch tcb) = arch_tcb_context_get (tcb_arch tcb'))) \<and> tcb_at (idle_thread s) s = tcb_at (idle_thread s) s' \<and> cur_thread s = cur_thread s' \<and> dom (device_state sa) = dom (device_state t)\<rbrakk> \<Longrightarrow> kheap s (arm_global_pd (arch_state s')) = kheap s' (arm_global_pd (arch_state s')) \<and> tcb_at (idle_thread s') s = tcb_at (idle_thread s') s' \<and> (\<forall>asid. asid \<noteq> 0 \<and> aag_can_affect_asid aag l asid \<longrightarrow> (\<forall>pool_ptr. asid_table s' (asid_high_bits_of asid) = Some pool_ptr \<longrightarrow> typ_at (AArch AASIDPool) pool_ptr s = typ_at (AArch AASIDPool) pool_ptr s')) proof (prove)
goal:
No subgoals!