(*<*)

(* Author: Kyndylan Nienhuis *)

theory StoreCap

imports
  "UnpredictableBehaviour"
  "ExceptionFlag"
  "ExecutionStep"
begin

(*>*)
section \<open>Semantics of @{const StoreCapAction}}\<close>

named_theorems SemanticsStoreCapI

method SemanticsStoreCap uses intro =
  HoareTriple intro: intro SemanticsStoreCapI[THEN HoareTriple_post_weakening]

declare nonExceptionCase_exceptions [SemanticsStoreCapI]

definition AddressIsCapWritable ::
  "Capability \<Rightarrow> Capability \<Rightarrow> PhysicalCapAddress \<Rightarrow>
   (VirtualAddress \<times> AccessType \<Rightarrow> PhysicalAddress option) \<Rightarrow> bool"
where
  "AddressIsCapWritable authCap cap a addrTrans \<equiv>
   Permit_Store (getPerms authCap) \<and>
   Permit_Store_Capability (getPerms authCap) \<and>
   getTag authCap \<and>
   \<not> getSealed authCap \<and>
   (getTag cap \<longrightarrow> \<not> Global (getPerms cap) \<longrightarrow>
    Permit_Store_Local_Capability (getPerms authCap)) \<and>
   (\<forall>a'\<in>Region (ExtendCapAddress a) 32.
    \<exists>vAddr\<in>RegionOfCap authCap.
    addrTrans (vAddr, STORE) = Some a')"

lemma AddressIsCapWritableI:
  assumes v_upper: "ucast vAddr + (32::65 word) \<le>
                    ucast (getBase authCap) + ucast (getLength authCap)"
      and v_lower: "getBase authCap \<le> vAddr"
      and alignment: "isCapAligned vAddr"
      and pAddr: "getTranslateAddr (vAddr, STORE) s = Some pAddr"
      and a: "a = GetCapAddress pAddr"
      and trans: "addrTrans = getTranslateAddrFunc s"
      and "Permit_Store (getPerms authCap)"
      and "Permit_Store_Capability (getPerms authCap)"
      and "getTag authCap"
      and "\<not> getSealed authCap"
      and "getTag cap \<Longrightarrow>
           \<not> Global (getPerms cap) \<Longrightarrow>
           Permit_Store_Local_Capability (getPerms authCap)"
  shows "AddressIsCapWritable authCap cap a addrTrans"
proof -
  have "(ucast vAddr::5 word) = 0"
    using alignment
    unfolding isCapAligned_def
    by simp
  have "(ucast pAddr::5 word) = 0"
    using arg_cong[where f="\<lambda>x. (ucast x::5 word)",
                   OF getTranslateAddr_ucast12[OF pAddr]]
    using `(ucast vAddr::5 word) = 0`
    by simp
  hence [simp]: "pAddr AND mask 5 = 0"
    using eq_ucast_eq_and_mask[where x=pAddr and y=0 and n=5 and 'b=5]
    by simp
  have [simp]: "pAddr AND NOT mask 5 = pAddr"
    unfolding word_minus_word_and_mask[THEN sym]
    by (simp del: word_minus_word_and_mask)
  note TranslateNearbyAddress_CapAligned2 =
       TranslateNearbyAddress_CapAligned
            [where cap=authCap and vAddr=vAddr and
                   pAddr=pAddr and s=s and accessType=STORE]
  show ?thesis
    using assms
    unfolding AddressIsCapWritable_def
    unfolding getTranslateAddrFunc_def
    unfolding ExtendCapAddress_def GetCapAddress_def
    by (auto elim!: TranslateNearbyAddress_CapAligned2)
qed

definition SemanticsStoreCapPost where
  "SemanticsStoreCapPost authCap cap a addrTrans \<equiv>
   return (AddressIsCapWritable authCap cap a addrTrans) \<and>\<^sub>b
   (read_state (getMemCap a) =\<^sub>b return cap)"

lemma Commute_SemanticsStoreCapPost [Commute_compositeI]:
  assumes "Commute (read_state (getMemCap a)) m"
  shows "Commute (SemanticsStoreCapPost authCap cap a addrTrans) m"
unfolding SemanticsStoreCapPost_def
by (Commute intro: assms)

lemma SemanticsStoreCapability_WriteCap [SemanticsStoreCapI]:
  shows "HoareTriple (if fst v = a then return (snd v = cap)
                  else read_state (getMemCap a) =\<^sub>b return cap)
                 (WriteCap v)
                 (\<lambda>_. read_state (getMemCap a) =\<^sub>b return cap)"
unfolding HoareTriple_def
by (cases v) (simp add: ValueAndStatePart_simp)

lemmas SemanticsStoreCapability_AddressTranslation =
  HoareTriple_DefinedAddressTranslation
    [where p="\<lambda>x. return (AddressIsCapWritable authCap cap a' addrTrans) \<and>\<^sub>b
                  (bind (read_state getLLbit)
                   (\<lambda>y. if (slice 5 x = a) \<and> (cond \<longrightarrow> y = Some True)
                        then return (cap' = cap)
                        else read_state (getMemCap a) =\<^sub>b return cap)) \<and>\<^sub>b
                  return extra"]
  for a a' cap cap' authCap addrTrans cond extra

lemma SemanticsStoreCapability_StoreCap:
  shows "HoareTriple (read_state getExceptionSignalled \<or>\<^sub>b
                  read_state isUnpredictable \<or>\<^sub>b
                  bind (read_state (getTranslateAddr (vAddr', STORE)))
                       (\<lambda>x. case x of None \<Rightarrow> return True
                                    | Some y \<Rightarrow>
                                      return (AddressIsCapWritable authCap cap a addrTrans) \<and>\<^sub>b
                                      (bind (read_state getLLbit)
                                            (\<lambda>z. if (slice 5 y = a) \<and>
                                                     (cond \<longrightarrow> z = Some True)
                                                 then return (cap' = cap)
                                                 else read_state (getMemCap a) =\<^sub>b return cap))) \<and>\<^sub>b
                  return authAccessible)
                 (StoreCap (vAddr', cap', cond))
                 (\<lambda>_. read_state getExceptionSignalled \<or>\<^sub>b
                      read_state isUnpredictable \<or>\<^sub>b
                      SemanticsStoreCapPost authCap cap a addrTrans \<and>\<^sub>b
                      return authAccessible)"
proof -
  note [SemanticsStoreCapI] =
     SemanticsStoreCapability_AddressTranslation
       [where cond=cond and cap'=cap' and a=a and extra=authAccessible]
  show ?thesis
    unfolding StoreCap_alt_def
    unfolding SemanticsStoreCapPost_def
    by (simp, SemanticsStoreCap) auto
qed

lemma SemanticsStoreCapability_CSC [SemanticsStoreCapI]:
  shows "HoareTriple ((return cap =\<^sub>b read_state (getCAPR cd)) \<and>\<^sub>b
                  (return authCap =\<^sub>b read_state (getCapReg auth)) \<and>\<^sub>b
                  (return addrTrans =\<^sub>b read_state getTranslateAddrFunc) \<and>\<^sub>b
                  (return authAccessible =\<^sub>b read_state (getRegisterIsAccessible auth)) \<and>\<^sub>b
                  bind (CSCActions v) (\<lambda>prov. return (StoreCapAction auth cd a \<in> prov)))
                 (dfn'CSC v)
                 (\<lambda>_. read_state getExceptionSignalled \<or>\<^sub>b
                      read_state isUnpredictable \<or>\<^sub>b
                      SemanticsStoreCapPost authCap cap a addrTrans \<and>\<^sub>b
                      return authAccessible)"
proof -
  note [SemanticsStoreCapI] =
    SemanticsStoreCapability_StoreCap[where authAccessible=authAccessible]
  note TranslateNearbyAddress_CapAligned2 =
    TranslateNearbyAddress_CapAligned
      [where pAddr="ExtendCapAddress a" and accessType=STORE]
  show ?thesis
    unfolding dfn'CSC_alt_def CSCActions_def
    unfolding CSCPhysicalAddress_def CSCVirtualAddress_def
    by SemanticsStoreCap
       (auto simp: not_le not_less
                   GetCapAddress_def ExtendCapAddress_def
                   getTranslateAddrFunc_def
             split: option.splits
             intro!: AddressIsCapWritableI)
qed

lemma SemanticsStoreCapability_CSCC [SemanticsStoreCapI]:
  shows "HoareTriple ((return cap =\<^sub>b read_state (getCAPR cd)) \<and>\<^sub>b
                  (return authCap =\<^sub>b read_state (getCapReg auth)) \<and>\<^sub>b
                  (return addrTrans =\<^sub>b read_state getTranslateAddrFunc) \<and>\<^sub>b
                  (return authAccessible =\<^sub>b read_state (getRegisterIsAccessible auth)) \<and>\<^sub>b
                  bind (CSCCActions v) (\<lambda>prov. return (StoreCapAction auth cd a \<in> prov)))
                 (dfn'CSCC v)
                 (\<lambda>_. read_state getExceptionSignalled \<or>\<^sub>b
                      read_state isUnpredictable \<or>\<^sub>b
                      SemanticsStoreCapPost authCap cap a addrTrans \<and>\<^sub>b
                      return authAccessible)"
proof -
  note [SemanticsStoreCapI] =
    SemanticsStoreCapability_StoreCap[where authAccessible=authAccessible]
  show ?thesis
    unfolding dfn'CSCC_alt_def CSCCActions_def
    unfolding CSCCPhysicalAddress_def CSCCVirtualAddress_def
    by SemanticsStoreCap
       (auto simp: not_le not_less if_distrib[where f="\<lambda>x. _ \<in> x"]
                   GetCapAddress_def ExtendCapAddress_def
                   getTranslateAddrFunc_def
             split: option.splits if_splits
             intro!: AddressIsCapWritableI)
qed

lemma SemanticsStoreCapability_Run_aux:
  shows "HoareTriple ((return cap =\<^sub>b read_state (getCAPR cd)) \<and>\<^sub>b
                  (return authCap =\<^sub>b read_state (getCapReg auth)) \<and>\<^sub>b
                  (return addrTrans =\<^sub>b read_state getTranslateAddrFunc) \<and>\<^sub>b
                  (return authAccessible =\<^sub>b read_state (getRegisterIsAccessible auth)) \<and>\<^sub>b
                  bind (RunActions v) (\<lambda>prov. return (StoreCapAction auth cd a \<in> prov)))
                 (Run v)
                 (\<lambda>_. read_state getExceptionSignalled \<or>\<^sub>b
                      read_state isUnpredictable \<or>\<^sub>b
                      SemanticsStoreCapPost authCap cap a addrTrans \<and>\<^sub>b
                      return authAccessible)"
unfolding Run_alt_def RunActions_def
by (HoareTriple_cases;
    rule HoareTriple_pre_strengthening,
    rule SemanticsStoreCapability_CSC
         SemanticsStoreCapability_CSCC
         HoareTriple_weakest_pre_any,
    solves \<open>auto simp: ValueAndStatePart_simp\<close>)

lemmas SemanticsStoreCapability_Run =
  HoareTriple_weakest_pre_disj[OF SemanticsStoreCapability_Run_aux
                              UndefinedCase_Run]

lemma SemanticsStoreCapability_Fetch:
  fixes auth a a' cd authCap cap addrTrans cdAccessible authAccessible
  defines "p \<equiv> \<lambda>w. (return cap =\<^sub>b read_state (getCAPR cd)) \<and>\<^sub>b
                    (return authCap =\<^sub>b read_state (getCapReg auth)) \<and>\<^sub>b
                    (return addrTrans =\<^sub>b read_state getTranslateAddrFunc) \<and>\<^sub>b
                    (return authAccessible =\<^sub>b read_state (getRegisterIsAccessible auth)) \<and>\<^sub>b
                    bind (RunActions (Decode w)) (\<lambda>ac. return (StoreCapAction auth cd a \<in> ac))"
  shows "HoareTriple (bind NextInstruction (case_option (return True) p))
                  Fetch
                  (\<lambda>b. case b of None \<Rightarrow> read_state getExceptionSignalled
                               | Some y \<Rightarrow> read_state isUnpredictable \<or>\<^sub>b p y)"
unfolding p_def
by (intro HoareTriple_Fetch) Commute+

lemma SemanticsStoreCapability_NextWithGhostState:
  shows "HoareTriple ((return cap =\<^sub>b read_state (getCAPR cd)) \<and>\<^sub>b
                  (return authCap =\<^sub>b read_state (getCapReg auth)) \<and>\<^sub>b
                  (return addrTrans =\<^sub>b read_state getTranslateAddrFunc) \<and>\<^sub>b
                  (return authAccessible =\<^sub>b read_state (getRegisterIsAccessible auth)) \<and>\<^sub>b
                  bind DomainActions (\<lambda>ac. return (StoreCapAction auth cd a \<in> ac)))
                 NextWithGhostState
                 (\<lambda>_. read_state getExceptionSignalled \<or>\<^sub>b
                      read_state isUnpredictable \<or>\<^sub>b
                      SemanticsStoreCapPost authCap cap a addrTrans \<and>\<^sub>b
                      return authAccessible)"
proof -
  note [SemanticsStoreCapI] =
    SemanticsStoreCapability_Run[where auth=auth and
                                       authAccessible=authAccessible]
  note [SemanticsStoreCapI] =
    SemanticsStoreCapability_Fetch[where auth=auth and a=a and cd=cd and
                                         cap=cap and authCap=authCap and
                                         addrTrans=addrTrans and
                                         authAccessible=authAccessible]
  show ?thesis
    unfolding NextWithGhostState_def DomainActions_def
    by (SemanticsStoreCap intro: UndefinedCase_TakeBranch)
       (auto split: option.splits)
qed

theorem SemanticsStoreCap:
  assumes prov: "StoreCapAction auth cd a \<in> actions"
      and suc: "(PreserveDomain actions, s') \<in> SemanticsCheriMips s"
  shows "Permit_Store (getPerms (getCapReg auth s))"
        "Permit_Store_Capability (getPerms (getCapReg auth s))"
        "getTag (getCapReg auth s)"
        "\<not> getSealed (getCapReg auth s)"
        "getTag (getCAPR cd s) \<and> \<not> Global (getPerms (getCAPR cd s)) \<longrightarrow>
         Permit_Store_Local_Capability (getPerms (getCapReg auth s))"
        "Region (ExtendCapAddress a) 32 \<subseteq>
         getTranslateAddresses (RegionOfCap (getCapReg auth s)) STORE s"
        "getRegisterIsAccessible auth s"
        "getMemCap a s' = getCAPR cd s"
using assms
using SemanticsStoreCapability_NextWithGhostState
         [where cap="getCAPR cd s" and cd=cd and a=a and auth=auth and
                authCap="getCapReg auth s" and
                addrTrans="getTranslateAddrFunc s" and
                authAccessible="getRegisterIsAccessible auth s",
          THEN HoareTripleE[where s=s]]
unfolding SemanticsStoreCapPost_def
unfolding AddressIsCapWritable_def
unfolding getTranslateAddrFunc_def getTranslateAddresses_def
unfolding SemanticsCheriMips_def Next_NextWithGhostState NextNonExceptionStep_def
by (auto simp: ValueAndStatePart_simp split: if_splits option.splits)

corollary StoreCapInstantiation:
  assumes "(lbl, s') \<in> SemanticsCheriMips s"
  shows "StoreCapProp s lbl s'"
unfolding StoreCapProp_def
using assms SemanticsStoreCap
by metis

corollary StoreLocalCapInstantiation:
  assumes "(lbl, s') \<in> SemanticsCheriMips s"
  shows "StoreLocalCapProp s lbl s'"
unfolding StoreLocalCapProp_def
using assms SemanticsStoreCap
by metis

(*<*)
end
(*>*)


(*  Title:      HOL/Auth/n_g2kAbsAfter_lemma_inv__57_on_rules.thy
    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences
    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences
*)

header{*The n_g2kAbsAfter Protocol Case Study*}

theory n_g2kAbsAfter_lemma_inv__57_on_rules imports n_g2kAbsAfter_lemma_on_inv__57
begin
section{*All lemmas on causal relation between inv__57*}
lemma lemma_inv__57_on_rules:
  assumes b1: "r \<in> rules N" and b2: "(f=inv__57  )"
  shows "invHoldForRule s f r (invariants N)"
  proof -
  have c1: "(\<exists> d. d\<le>N\<and>r=n_n_Store_i1  d)\<or>
    (\<exists> d. d\<le>N\<and>r=n_n_AStore_i1  d)\<or>
    (r=n_n_SendReqS_j1  )\<or>
    (r=n_n_SendReqEI_i1  )\<or>
    (r=n_n_SendReqES_i1  )\<or>
    (r=n_n_RecvReq_i1  )\<or>
    (r=n_n_SendInvE_i1  )\<or>
    (r=n_n_SendInvS_i1  )\<or>
    (r=n_n_SendInvAck_i1  )\<or>
    (r=n_n_RecvInvAck_i1  )\<or>
    (r=n_n_SendGntS_i1  )\<or>
    (r=n_n_SendGntE_i1  )\<or>
    (r=n_n_RecvGntS_i1  )\<or>
    (r=n_n_RecvGntE_i1  )\<or>
    (r=n_n_ASendReqIS_j1  )\<or>
    (r=n_n_ASendReqSE_j1  )\<or>
    (r=n_n_ASendReqEI_i1  )\<or>
    (r=n_n_ASendReqES_i1  )\<or>
    (r=n_n_SendReqEE_i1  )\<or>
    (r=n_n_ARecvReq_i1  )\<or>
    (r=n_n_ASendInvE_i1  )\<or>
    (r=n_n_ASendInvS_i1  )\<or>
    (r=n_n_ASendInvAck_i1  )\<or>
    (r=n_n_ARecvInvAck_i1  )\<or>
    (r=n_n_ASendGntS_i1  )\<or>
    (r=n_n_ASendGntE_i1  )\<or>
    (r=n_n_ARecvGntS_i1  )\<or>
    (r=n_n_ARecvGntE_i1  )"
  apply (cut_tac b1, auto) done
    moreover {
      assume d1: "(\<exists> d. d\<le>N\<and>r=n_n_Store_i1  d)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_n_Store_i1Vsinv__57) done
    }

    moreover {
      assume d1: "(\<exists> d. d\<le>N\<and>r=n_n_AStore_i1  d)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_n_AStore_i1Vsinv__57) done
    }

    moreover {
      assume d1: "(r=n_n_SendReqS_j1  )"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_n_SendReqS_j1Vsinv__57) done
    }

    moreover {
      assume d1: "(r=n_n_SendReqEI_i1  )"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_n_SendReqEI_i1Vsinv__57) done
    }

    moreover {
      assume d1: "(r=n_n_SendReqES_i1  )"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_n_SendReqES_i1Vsinv__57) done
    }

    moreover {
      assume d1: "(r=n_n_RecvReq_i1  )"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_n_RecvReq_i1Vsinv__57) done
    }

    moreover {
      assume d1: "(r=n_n_SendInvE_i1  )"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_n_SendInvE_i1Vsinv__57) done
    }

    moreover {
      assume d1: "(r=n_n_SendInvS_i1  )"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_n_SendInvS_i1Vsinv__57) done
    }

    moreover {
      assume d1: "(r=n_n_SendInvAck_i1  )"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_n_SendInvAck_i1Vsinv__57) done
    }

    moreover {
      assume d1: "(r=n_n_RecvInvAck_i1  )"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_n_RecvInvAck_i1Vsinv__57) done
    }

    moreover {
      assume d1: "(r=n_n_SendGntS_i1  )"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_n_SendGntS_i1Vsinv__57) done
    }

    moreover {
      assume d1: "(r=n_n_SendGntE_i1  )"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_n_SendGntE_i1Vsinv__57) done
    }

    moreover {
      assume d1: "(r=n_n_RecvGntS_i1  )"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_n_RecvGntS_i1Vsinv__57) done
    }

    moreover {
      assume d1: "(r=n_n_RecvGntE_i1  )"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_n_RecvGntE_i1Vsinv__57) done
    }

    moreover {
      assume d1: "(r=n_n_ASendReqIS_j1  )"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_n_ASendReqIS_j1Vsinv__57) done
    }

    moreover {
      assume d1: "(r=n_n_ASendReqSE_j1  )"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_n_ASendReqSE_j1Vsinv__57) done
    }

    moreover {
      assume d1: "(r=n_n_ASendReqEI_i1  )"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_n_ASendReqEI_i1Vsinv__57) done
    }

    moreover {
      assume d1: "(r=n_n_ASendReqES_i1  )"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_n_ASendReqES_i1Vsinv__57) done
    }

    moreover {
      assume d1: "(r=n_n_SendReqEE_i1  )"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_n_SendReqEE_i1Vsinv__57) done
    }

    moreover {
      assume d1: "(r=n_n_ARecvReq_i1  )"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_n_ARecvReq_i1Vsinv__57) done
    }

    moreover {
      assume d1: "(r=n_n_ASendInvE_i1  )"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_n_ASendInvE_i1Vsinv__57) done
    }

    moreover {
      assume d1: "(r=n_n_ASendInvS_i1  )"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_n_ASendInvS_i1Vsinv__57) done
    }

    moreover {
      assume d1: "(r=n_n_ASendInvAck_i1  )"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_n_ASendInvAck_i1Vsinv__57) done
    }

    moreover {
      assume d1: "(r=n_n_ARecvInvAck_i1  )"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_n_ARecvInvAck_i1Vsinv__57) done
    }

    moreover {
      assume d1: "(r=n_n_ASendGntS_i1  )"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_n_ASendGntS_i1Vsinv__57) done
    }

    moreover {
      assume d1: "(r=n_n_ASendGntE_i1  )"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_n_ASendGntE_i1Vsinv__57) done
    }

    moreover {
      assume d1: "(r=n_n_ARecvGntS_i1  )"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_n_ARecvGntS_i1Vsinv__57) done
    }

    moreover {
      assume d1: "(r=n_n_ARecvGntE_i1  )"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_n_ARecvGntE_i1Vsinv__57) done
    }

  ultimately show "invHoldForRule s f r (invariants N)"
  by satx
qed

end


(*  Title:      HOL/Auth/n_german_lemma_inv__5_on_rules.thy
    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences
    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences
*)

(*header{*The n_german Protocol Case Study*}*)

theory n_german_lemma_inv__5_on_rules imports n_german_lemma_on_inv__5
begin
section{*All lemmas on causal relation between inv__5*}
lemma lemma_inv__5_on_rules:
  assumes b1: "r \<in> rules N" and b2: "(\<exists> p__Inv0 p__Inv2. p__Inv0\<le>N\<and>p__Inv2\<le>N\<and>p__Inv0~=p__Inv2\<and>f=inv__5  p__Inv0 p__Inv2)"
  shows "invHoldForRule s f r (invariants N)"
  proof -
  have c1: "(\<exists> i d. i\<le>N\<and>d\<le>N\<and>r=n_Store  i d)\<or>
    (\<exists> i. i\<le>N\<and>r=n_SendReqS  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_SendReqE__part__0  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_SendReqE__part__1  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_RecvReqS N i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_RecvReqE N i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_SendInv__part__0  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_SendInv__part__1  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_SendInvAck  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_RecvInvAck  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_SendGntS  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_SendGntE N i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_RecvGntS  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_RecvGntE  i)"
  apply (cut_tac b1, auto) done
    moreover {
      assume d1: "(\<exists> i d. i\<le>N\<and>d\<le>N\<and>r=n_Store  i d)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_StoreVsinv__5) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_SendReqS  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendReqSVsinv__5) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_SendReqE__part__0  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendReqE__part__0Vsinv__5) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_SendReqE__part__1  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendReqE__part__1Vsinv__5) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_RecvReqS N i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_RecvReqSVsinv__5) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_RecvReqE N i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_RecvReqEVsinv__5) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_SendInv__part__0  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendInv__part__0Vsinv__5) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_SendInv__part__1  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendInv__part__1Vsinv__5) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_SendInvAck  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendInvAckVsinv__5) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_RecvInvAck  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__5) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_SendGntS  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendGntSVsinv__5) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_SendGntE N i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendGntEVsinv__5) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_RecvGntS  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_RecvGntSVsinv__5) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_RecvGntE  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_RecvGntEVsinv__5) done
    }

  ultimately show "invHoldForRule s f r (invariants N)"
  by satx
qed

end


(*  Title:      HOL/Auth/n_german_lemma_inv__40_on_rules.thy
    Author:     Yongjian Li and Kaiqiang Duan, State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences
    Copyright    2016 State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences
*)

header{*The n_german Protocol Case Study*}

theory n_german_lemma_inv__40_on_rules imports n_german_lemma_on_inv__40
begin
section{*All lemmas on causal relation between inv__40*}
lemma lemma_inv__40_on_rules:
  assumes b1: "r \<in> rules N" and b2: "(\<exists> p__Inv3 p__Inv4. p__Inv3\<le>N\<and>p__Inv4\<le>N\<and>p__Inv3~=p__Inv4\<and>f=inv__40  p__Inv3 p__Inv4)"
  shows "invHoldForRule s f r (invariants N)"
  proof -
  have c1: "(\<exists> j. j\<le>N\<and>r=n_SendReqS  j)\<or>
    (\<exists> i. i\<le>N\<and>r=n_SendReqEI  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_SendReqES  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_RecvReq N i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_SendInvE  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_SendInvS  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_SendInvAck  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_RecvInvAck  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_SendGntS  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_SendGntE N i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_RecvGntS  i)\<or>
    (\<exists> i. i\<le>N\<and>r=n_RecvGntE  i)\<or>
    (\<exists> i d. i\<le>N\<and>d\<le>N\<and>r=n_Store  i d)"
  apply (cut_tac b1, auto) done
    moreover {
      assume d1: "(\<exists> j. j\<le>N\<and>r=n_SendReqS  j)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendReqSVsinv__40) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_SendReqEI  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendReqEIVsinv__40) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_SendReqES  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendReqESVsinv__40) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_RecvReq N i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_RecvReqVsinv__40) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_SendInvE  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendInvEVsinv__40) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_SendInvS  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendInvSVsinv__40) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_SendInvAck  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendInvAckVsinv__40) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_RecvInvAck  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_RecvInvAckVsinv__40) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_SendGntS  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendGntSVsinv__40) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_SendGntE N i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_SendGntEVsinv__40) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_RecvGntS  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_RecvGntSVsinv__40) done
    }

    moreover {
      assume d1: "(\<exists> i. i\<le>N\<and>r=n_RecvGntE  i)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_RecvGntEVsinv__40) done
    }

    moreover {
      assume d1: "(\<exists> i d. i\<le>N\<and>d\<le>N\<and>r=n_Store  i d)"
      have "invHoldForRule s f r (invariants N)"
      apply (cut_tac b2 d1, metis n_StoreVsinv__40) done
    }

  ultimately show "invHoldForRule s f r (invariants N)"
  by satx
qed

end