theory TCB_DP

lemma tcb_empty_thread_slot_wp: "\<lbrace><(target_tcb,slot) \<mapsto>c NullCap \<and>* R>\<rbrace> tcb_empty_thread_slot target_tcb slot \<lbrace>\<lambda>_. <(target_tcb,slot) \<mapsto>c NullCap \<and>* R>\<rbrace> " apply (simp add:tcb_empty_thread_slot_def whenE_def | wp)+ apply (rule valid_validE) apply (rule hoare_pre_cont) apply simp apply wp+ apply (clarsimp dest!:opt_cap_sep_imp simp:reset_cap_asid_simps2) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>cdl.lift ((target_tcb, slot) \<mapsto>c NullCap \<and>* R)\<rbrace> tcb_empty_thread_slot target_tcb slot \<lbrace>\<lambda>_. cdl.lift ((target_tcb, slot) \<mapsto>c NullCap \<and>* R)\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>cap. cap \<noteq> NullCap \<Longrightarrow> \<lbrace>?Q3 cap\<rbrace> delete_cap (target_tcb, slot) \<lbrace>\<lambda>_. cdl.lift ((target_tcb, slot) \<mapsto>c NullCap \<and>* R)\<rbrace>, \<lbrace>\<lambda>_. cdl.lift ((target_tcb, slot) \<mapsto>c NullCap \<and>* R)\<rbrace>
 2. \<And>cap. \<not> cap \<noteq> NullCap \<Longrightarrow> \<lbrace>?R3 cap\<rbrace> returnOk () \<lbrace>\<lambda>_. cdl.lift ((target_tcb, slot) \<mapsto>c NullCap \<and>* R)\<rbrace>, \<lbrace>\<lambda>_. cdl.lift ((target_tcb, slot) \<mapsto>c NullCap \<and>* R)\<rbrace>
 3. \<lbrace>?Q\<rbrace> liftE (get_cap (target_tcb, slot)) \<lbrace>\<lambda>cap s. (cap \<noteq> NullCap \<longrightarrow> ?Q3 cap s) \<and> (\<not> cap \<noteq> NullCap \<longrightarrow> ?R3 cap s)\<rbrace>, \<lbrace>\<lambda>_. cdl.lift ((target_tcb, slot) \<mapsto>c NullCap \<and>* R)\<rbrace>
 4. \<And>s. cdl.lift ((target_tcb, slot) \<mapsto>c NullCap \<and>* R) s \<Longrightarrow> ?Q s proof (prove)
goal (4 subgoals):
 1. \<And>cap. cap \<noteq> NullCap \<Longrightarrow> \<lbrace>?Q3 cap\<rbrace> delete_cap (target_tcb, slot) \<lbrace>\<lambda>_. cdl.lift ((target_tcb, slot) \<mapsto>c NullCap \<and>* R)\<rbrace>
 2. \<And>cap. \<not> cap \<noteq> NullCap \<Longrightarrow> \<lbrace>?R3 cap\<rbrace> returnOk () \<lbrace>\<lambda>_. cdl.lift ((target_tcb, slot) \<mapsto>c NullCap \<and>* R)\<rbrace>, \<lbrace>\<lambda>_. cdl.lift ((target_tcb, slot) \<mapsto>c NullCap \<and>* R)\<rbrace>
 3. \<lbrace>?Q\<rbrace> liftE (get_cap (target_tcb, slot)) \<lbrace>\<lambda>cap s. (cap \<noteq> NullCap \<longrightarrow> ?Q3 cap s) \<and> (\<not> cap \<noteq> NullCap \<longrightarrow> ?R3 cap s)\<rbrace>, \<lbrace>\<lambda>_. cdl.lift ((target_tcb, slot) \<mapsto>c NullCap \<and>* R)\<rbrace>
 4. \<And>s. cdl.lift ((target_tcb, slot) \<mapsto>c NullCap \<and>* R) s \<Longrightarrow> ?Q s proof (prove)
goal (3 subgoals):
 1. \<And>cap. \<not> cap \<noteq> NullCap \<Longrightarrow> \<lbrace>?R3 cap\<rbrace> returnOk () \<lbrace>\<lambda>_. cdl.lift ((target_tcb, slot) \<mapsto>c NullCap \<and>* R)\<rbrace>, \<lbrace>\<lambda>_. cdl.lift ((target_tcb, slot) \<mapsto>c NullCap \<and>* R)\<rbrace>
 2. \<lbrace>?Q\<rbrace> liftE (get_cap (target_tcb, slot)) \<lbrace>\<lambda>cap s. (cap \<noteq> NullCap \<longrightarrow> False) \<and> (\<not> cap \<noteq> NullCap \<longrightarrow> ?R3 cap s)\<rbrace>, \<lbrace>\<lambda>_. cdl.lift ((target_tcb, slot) \<mapsto>c NullCap \<and>* R)\<rbrace>
 3. \<And>s. cdl.lift ((target_tcb, slot) \<mapsto>c NullCap \<and>* R) s \<Longrightarrow> ?Q s proof (prove)
goal (3 subgoals):
 1. \<lbrace>?R3 NullCap\<rbrace> returnOk () \<lbrace>\<lambda>_. cdl.lift ((target_tcb, slot) \<mapsto>c NullCap \<and>* R)\<rbrace>, \<lbrace>\<lambda>_. cdl.lift ((target_tcb, slot) \<mapsto>c NullCap \<and>* R)\<rbrace>
 2. \<lbrace>?Q\<rbrace> liftE (get_cap (target_tcb, slot)) \<lbrace>\<lambda>cap s. (cap \<noteq> NullCap \<longrightarrow> False) \<and> (\<not> cap \<noteq> NullCap \<longrightarrow> ?R3 cap s)\<rbrace>, \<lbrace>\<lambda>_. cdl.lift ((target_tcb, slot) \<mapsto>c NullCap \<and>* R)\<rbrace>
 3. \<And>s. cdl.lift ((target_tcb, slot) \<mapsto>c NullCap \<and>* R) s \<Longrightarrow> ?Q s proof (prove)
goal (1 subgoal):
 1. \<And>s. cdl.lift ((target_tcb, slot) \<mapsto>c NullCap \<and>* R) s \<Longrightarrow> opt_cap (target_tcb, slot) s \<noteq> None \<longrightarrow> (the (opt_cap (target_tcb, slot) s) \<noteq> NullCap \<longrightarrow> False) \<and> (\<not> the (opt_cap (target_tcb, slot) s) \<noteq> NullCap \<longrightarrow> cdl.lift ((target_tcb, slot) \<mapsto>c NullCap \<and>* R) s) proof (prove)
goal:
No subgoals!